There is a web server in the virtual machine.

It is necessary to make sure that all traffic on ports 80 and 443 is wrapped on this virtual machine without changing the client's ip-address.

My iptables:

iptables -F iptables -t nat -F iptables -t mangle -F iptables -X iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o vmbr0 -j SNAT --to-source 'xxxx iptables -t nat -A POSTROUTING -o vmbr1 -j SNAT --to-source 192.168.0.1 iptables -t nat -I PREROUTING -p udp -m udp --dport 60000:61000 -j DNAT --to 192.168.0.200:60000-61000 iptables -A PREROUTING -t nat -i vmbr0 -p tcp -d 'xxxx --dport 18180 -j DNAT --to 192.168.0.200:22 iptables -A PREROUTING -t nat -i vmbr0 -p tcp -d 'xxxx --dport 17172 -j DNAT --to 192.168.0.102:22 iptables -A PREROUTING -t nat -i vmbr0 -p tcp -d 'xxxx --dport 17171 -j DNAT --to 192.168.0.101:22 iptables -A PREROUTING -t nat -i vmbr0 -p tcp -d 'xxxx --dport 3000 -j DNAT --to 192.168.0.101:3000 iptables -A PREROUTING -t nat -i vmbr0 -p tcp -d 'xxxx --dport 443 -j DNAT --to 192.168.0.200:443 iptables -A PREROUTING -t nat -i vmbr0 -p tcp -d 'xxxx --dport 80 -j DNAT --to 192.168.0.1:80 iptables -A PREROUTING -t nat -i vmbr0 -p tcp -s yyyy -d 'xxxx --dport 8080 -j DNAT --to 192.168.0.102:80 iptables -A PREROUTING -t nat -i vmbr0 -p tcp -s yyyy -d 'xxxx --dport 8081 -j DNAT --to 192.168.0.102:8081 iptables -A INPUT -p TCP --dport 80 -j ACCEPT iptables -A OUTPUT -p TCP --dport 80 -j ACCEPT iptables -A INPUT -p TCP --dport 443 -j ACCEPT iptables -A OUTPUT -p TCP --dport 443 -j ACCEPT iptables -A INPUT -s yyyy -j ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #iptables -I INPUT 1 -p udp --dport 60000:61000 -j ACCEPT #iptables -A INPUT -p icmp --icmp-type echo-request -j REJECT --reject-with icmp-host-prohibited iptables -P INPUT DROP
  • one
    What solution is used for virtualization? They, you know, more than one. Or bring solutions for everyone? - Sergey
  • 2
    In general, I think like a normal redirect, using DNAT, i.e. substitution of the destination address to the address of the virtualka - Mike
  • Just Dnat configured, but in the headers passed the address vmbr0 - Anton Veselov
  • In which headers, in http, in what exactly and what is written? (when you answer, write clearly to @Mike, and then the alerts do not come and I do not know that they wrote something to me - Mike
  • @Mike Replaced with the address of the gateway vmbr1 192.168.0.1 - Anton Veselov

1 answer 1

as I understand it, it means traffic coming to the interface vmbr0 at address xxxx .

  1. these rules should be “brought to a common denominator”:

     iptables -A PREROUTING -t nat -i vmbr0 -p tcp -d 'xxxx --dport 443 -j DNAT --to 192.168.0.200:443 iptables -A PREROUTING -t nat -i vmbr0 -p tcp -d 'xxxx --dport 80 -j DNAT --to 192.168.0.1:80

    if the target virtual machine has an ip-address of 192.168.0.200 , then this ip-address should appear in the second rule.

  2. and this rule should be removed:

     iptables -t nat -A POSTROUTING -o vmbr1 -j SNAT --to-source 192.168.0.1
  3. On the target virtual machine, the default gateway must be assigned an ip-address that is assigned to the network interface (on the machine whose netfilter rules are given in the question) that is “looking” to the local network. as I understand it - 192.168.0.1 .
  • Well, yes it works psb - Anton Veselov